[Desktop] Disable nodeIntegration as a security precaution

electron/electron#5113

electron/electron#4362

PaulLeCam/react-native-electron#6

Author: brunolemos

@types/electron/index.d.ts

@@ -1,4 +1,7 @@
+/// <reference path="../../node_modules/electron/electron.d.ts" />
+
 interface Window {
+  ipc: Electron.IpcRenderer
   process?: {
     type?: string
   }

packages/components/src/libs/linking/index-electron.ts

@@ -2,40 +2,37 @@
 
 import _ from 'lodash'
 
-const { remote, shell } = window.require('electron')
-
 import { LinkingCrossPlatform } from './index'
+import { Linking as LinkingOriginal } from './index-native'
 
 const eventHandlers = new Map()
 
 export const Linking: LinkingCrossPlatform = {
   addEventListener: (type: string, handler: any) => {
     if (!(type === 'url' && typeof handler === 'function')) return
 
-    const wrapHandler = (_event: object, url: string) => {
+    const wrapHandler = (_e: any, url: string) => {
       handler({ type, url })
     }
 
     eventHandlers.set(handler, wrapHandler)
-    remote.app.on('open-url', wrapHandler)
+    window.ipc.addListener('open-url', wrapHandler)
   },
-  async canOpenURL() {
-    return true
+  async canOpenURL(url: string) {
+    return LinkingOriginal.canOpenURL(url)
   },
   async getInitialURL() {
-    return remote.process.argv[1] || null
+    return ''
   },
-  openURL: (url: string, options?: object): Promise<void> => {
-    return shell.openExternal(url, options)
-      ? Promise.resolve()
-      : Promise.reject(new Error('Could not open URL'))
+  openURL: (url: string): Promise<void> => {
+    return LinkingOriginal.openURL(url)
   },
   removeEventListener: (type: string, handler: any) => {
     if (!(type === 'url' && typeof handler === 'function')) return
 
     const wrapHandler = eventHandlers.get(handler)
     if (wrapHandler) {
-      remote.app.removeListener('open-url', wrapHandler)
+      window.ipc.removeListener('open-url', wrapHandler)
     }
 
     eventHandlers.delete(handler)

packages/desktop/src/index.ts

@@ -65,7 +65,8 @@ function getBrowserWindowOptions() {
       affinity: 'main-window',
       backgroundThrottling: false,
       nativeWindowOpen: true,
-      nodeIntegration: true,
+      nodeIntegration: false,
+      preload: path.join(__dirname, 'preload.js'),
     },
     ...(config.get('isMenuBarMode')
       ? {
@@ -261,6 +262,10 @@ function init() {
       },
     )
   })
+
+  app.on('open-url', (_event, url) => {
+    if (mainWindow) mainWindow.webContents.send('open-url', url)
+  })
 }
 
 function getCenterPosition(obj: Electron.BrowserWindow | Electron.Tray) {

packages/desktop/src/preload.ts

@@ -0,0 +1,3 @@
+import electron from 'electron'
+
+window.ipc = electron.ipcRenderer

tslint.json

@@ -14,6 +14,7 @@
     "no-console": [true, "debug", "dir", "log", "trace", "warn"],
     "no-empty-interface": false,
     "no-namespace": false,
+    "no-reference": false,
     "object-literal-sort-keys": false,
     "object-shorthand-properties-first": false,
     "prefer-array-literal": false,